Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 20 Apr 2016 22:57:24 +0200
From: "" <>
Subject: Re: Mandatory password changes - DIEDIEDIE!

> The statement will simply be something like "stop changing passwords
> frequently".


> We can no longer require users to have long & complex passwords, unique
> to every service & site, and additionally ask them to change them every
> 30-60-90 days.

it is important to separate all these 4 points.
1. WE CAN AND SHOULD REQUIRE users to have LONG passwords,
2. we can not say anything about "complex" because we do not know what 
is complex and if it is relevant to our problem.
3. uniqueness is a delicate issue, it is sufficient for a very small 
portion of your passwords to be unique. moreover it is good to have a 
single shitty passwords for forums and similar cesspools
4. compulsory expiration is a separate issue,
which is bad, but can be mitigated by writing passwords on paper.

> It create more problems than it solves, it is annoying,
> counterproductive and may result in users deliberately break security
> policies in order to get their work done.

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.